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Amendments to the Claims: 

This listing of the claims will replace all prior versions, and listings, of 
claims in the application: 

Listing of Claims : 
1-46 (Cancelled). 

47 (Currently Amended). A method of collecting information relating to a 
communication network and to substantially all nodes operating in said communication 
network, the method comprising: 

dotoct i na enabling detection , substant i a ll y i n roa l t i mo, oidata conveyed by 
one or more detected nodes operating in the communication network in a manner that is 
transparent to said one or more detected nodes, g i v i ng r i so to the -vield detected data, 
thereby dotoct i nq enabling detection of said data passively; 

analyzing said detected data and data relating to said communication 
network to identify for i dont i fy i nq at least one of identified information and missing 
information : 

said data relating to said communication network comprising node 
identification data : 

said identified information comprising at least one of nodal 
information relating to the one or more detected nodos; nodes and nodal 
information relating to said communication network: and 
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said missing information comprising at least one of missing 
information regarding at least one of said one or more detected nodes ; and and 
missing information regarding said communication network; and 

storing at least a part of the identified information on a storage device 
comprising a computer readable medium accessible thereto; 

if said missing information is identified, then querying at least one of one 
or more nodes operating in said communication network for said missing information 
provided at least partially from said storage device, g i v i ng r i so to yield the-gueried 
nodes, thereby co ll oct i ng enabling collection of said missing information actively. 

48 (Cancelled). 

49 (Previously Presented). The method of Claim 47, wherein the nodal 
information comprises operating system information relating to operating systems 
operating on the one or more nodes. 

50 (Previously Presented). The method of Claim 49, wherein the nodes 
are included in at least one of the following: detected nodes and queried nodes. 

51 (Previously Presented). The method of Claim 49, wherein the 
detection of the data comprises detecting at least one type of message from a group 
comprising DHCP (Dynamic Host Configuration Protocol) messages and SYN packets. 

52 (Currently Amended). The method of Claim 49, wherein the analyzing 
further comprises: 

receiving data corresponding to data conveyed by a detected node, g i v i ng 
fise-to yield the-received data; 



-5- 



Appln. No. 10/580,543 

Amdt. dated May 4, 2010 

Reply to Office action of January 4, 2010 

inspecting said received data for one or more characteristics of a known 
operating system; and 

if inspecting of said received data reveals that the data conforms with said 
one or more characteristics, indicating that the known operating system operates on the 
detected node. 

53 (Previously Presented). The method of Claim 47, wherein the nodal 
information comprises runtime information relating to running processes. 

54 (Previously Presented). The method of Claim 53, wherein the 
runtime information relating to running processes comprises at least one of the 
following: information relating to network running processes operating on the detected 
nodes; and information relating to local running processes operating on the detected 
nodes. 

55 (Previously Presented). The method of Claim 47, wherein the nodal 
information comprises hardware information relating to hardware components 
associated with the respective detected nodes. 

56 (Previously Presented). The method of Claim 47, wherein the nodal 
information comprises topology information relating to physical topology of the 
communication network. 

57 (Previously Presented). The method of Claim 47, wherein the 
querying further comprises: 

generating a query message corresponding to the missing information for 
conveying said query message to one or more nodes to be queried; 
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conveying the query message to said one or more nodes, giving rise to 
the queried nodes. 

58 (Previously Presented). The method of Claim 57, wherein the 
querying further comprises: 

receiving at least one response that corresponds to the query message; 

and 

processing the at least one response to retrieve information corresponding 
to the missing information. 

59 (Previously Presented). The method of Claim 57, wherein the query 
message is one of the following: an ARP (Address Resolution Protocol) request; an 
ICMP (Internet Control Message Protocol) echo request; and aTCP-SYN request. 

60 (Previously Presented). The method of Claim 57, wherein the 
generating is done in accordance with a test policy, and 

wherein the test policy is selected from a group of available test policies. 

61 (Previously Presented). The method of Claim 57, wherein the 
generating is done in accordance with a test policy, and 

wherein the test policy is selected in accordance with a statistical 

computation. 

62 (Previously Presented). The method of Claim 57, wherein said 
missing information relates to at least one running process operating on respective 
queried nodes. 
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63 (Previously Presented). The method of Claim 57, wherein the 
detected nodes comprises at least one queried node, and the data conveyed by 
detected nodes includes at least one response that corresponds to the query message. 

64 (Currently Amended). A network information collector configured to 
collect information relating to a communication network and to substantially all nodes 
operating in said communication network, the network information collector comprising: 

a network detector configured to dotoct enable detecting , substant i a ll y i n 
roa l t i mo, data conveyed by one or more detected nodes operating in the 
communication network in a manner that is transparent to the one or more detected 
nodes, g i v i ng r i so to yield t he-detected data, thereby detect i ng enabling detection of 
said data passively; 

an analyzer configured to analyze said detected data and data relating to 
said communication network for i dont i fv i ng to identify at least one of identified 
information and missing information : 

said data relating to said communication network comprising node 
identification data : 

said identified information comprising at least one of nodal 
information relating to said one or more detected nodoc: nodes and nodal 
information relating to said communication network; 

said missing information comprising at least one of missing 
information regarding at least one of said one or more detected nodes^-and and 
missing information regarding said communication network; and 
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a query engine conf i gure configured to query at least one of one or more 
nodes operating in said communication network for said missing information , if said 
missing information is identified , g i v i ng rise to yield the-queried nodes, thereby 
co ll ect i ng enabling collection of said missing information actively. 

65 (Cancelled). 

66 (Previously Presented). The network information collector of Claim 
64, wherein the analyzer is configured to analyze nodal information that includes 
operating system information relating to operating systems operating on the one or 
more detected nodes. 

67 (Previously Presented). The network information collector of Claim 
66, wherein the detection of the data conveyed by the one or more detected nodes 
comprises detecting at least one type of message from a group comprising DHCP 
(Dynamic Host Configuration Protocol) messages; and SYN packets. 

68 (Currently Amended). The network information collector of Claim 66, 
wherein the analyzer further comprises: 

an input device configured to receive data, giving rise to the detected 
received data, said received data corresponds to data conveyed by a detected node; 

a data inspector coupled to said input device, the data inspector being 
configured to inspect said received data for one or more characteristics of a known 
operating system; and 
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a data marker coupled to said data inspector and being responsive 
thereto, the data marker being configured to indicate that the known operating system 
operates on the detected node. 

69 (Previously Presented). The network information collector of Claim 
64, wherein the analyzer is configured to analyze nodal information that comprises 
runtime information relating to running processes. 

70 (Previously Presented). The network information collector of Claim 
64, wherein the query engine includes: 

a query message generator configured to generate a query message 
corresponding to the missing information for conveying said query message to nodes to 
be queried; and 

an output device configured to convey the query message to the nodes to 
be queried, giving rise to the queried nodes. 

71 (Previously Presented). The network information collector of Claim 
70, wherein the query engine further includes: 

an input device configured to receive at least one response that 
corresponds to the query message; and 

a response processor configured to process said at least one response to 
retrieve information corresponding to the missing information. 

72 (Currently Amended). A non-transitory program storage device 
readable by machine, tangibly embodying a program of instructions executable by the 
machine to perform method of collecting information relating to a communication 
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network and to substantially all nodes operating in said communication network, the 
method comprising: 

dotoct i ng enablinq detection , substantia ll y i n roa l t i mo, oidata conveyed by 
one or more detected nodes operating in the communication network in a manner that is 
transparent to said one or more detected nodes, g i v i ng r i so to tho to yield detected data, 
thereby dotoct i nq enabling detection of said data passively; 

analyzing said detected data and data relating to said communication 
network for identifying at least one of identified information and missing information : 

said data relating to said communication network comprising node 
identification data : 

said identified information comprising at least one of nodal 
information relating to said one or more detected nod o s: nodes and nodal 
information relating to said communication network; 

said missing information comprising at least one of missing 
information regarding at least one of said one or more detected nodes^-and and 
missing information regarding said communication network; and 

if said missing information is identified, then querying at least one of one 
or more nodes operating in said communication network for said missing information, 
g i v i ng r i so to yield t he-queried nodes, thereby co ll ect i ng enabling collection of said 
missing information actively. 

73 (Currently Amended). A computer program product comprising a non- 
transitory computer useable medium having computer readable program code 
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embodied therein for collecting information relating to a communication network and to 
substantially all nodes operating in said communication network, the computer program 
product comprising: 

computer readable program code for caus i ng enabling the computer to 
detect , substant i a ll y i n roa l t i mo, data conveyed by one or more detected nodes 
operating in the communication network in a manner that is transparent to said one or 
more detected nodes, g i v i ng r i so to yield the-detected data, thereby dotoct i ng enabling 
detection of said data passively; 

computer readable program code for causing the computer to analyze 
said detected data and data relating to said communication network for identifying_at 
least one of the identified information and missing information : 

said data relating to said communication network comprising node 
identification data : 

said identified information comprising at least one of nodal 
information relating to said one or more detected nodoe; nodes and nodal 
information relating to said communication network; 

said missing information comprising at least one of missing 
information regarding at least one of said one or more detected nodos; nodes 
and missing information regarding said communication network; and 

computer readable program code for causing the computer to query at 
least one of one or more nodes operating in said communication network for the 
missing information, if said missing information is identified, g i v i ng r i so to yield t he 
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queried nodes, thereby co ll ect i ng enabling collection of said missing information 
actively. 

74. (New) The method of Claim 47, wherein the step of enabling 
detection is performed in real-time. 

75. (New) The method of Claim 64, wherein the network detector is to 
enable detection in real-time. 
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